Fix the security audit's findings

Fixes the nine findings of security audit run 1 on 2.4.1 (T1-T11).

F1: Uploads that are not complete now count only the bytes the server
received, and a chunk that goes above the storage quota gets 422. An
anonymous uploader can no longer fill the quota with declared sizes.

F2: The share password and the admin login have a second limit without
the address (20 attempts per minute per share and per e-mail), because
a forged X-Forwarded-For changes the address.

F3: The system password gate and the admin check now also run on
Livewire updates, so an old uploader snapshot cannot register files.

F4: The session keeps a fingerprint of the system password's hash.
When the admin changes the system password, earlier verifications end.

F5: The page after the upload opens only in the session that created
the share, and only while recipients can still reach the share.

F6: The share password limit counts an attempt before the password is
checked, so parallel attempts cannot pass it.

F7: The system password has the same two limits (5 per address, 20 in
total per minute).

F8: A password change or reset signs the user's other sessions out.

F9: The only admin cannot delete the account, which would open /setup
to every visitor.

The setup wizard also holds the admin password to the password
defaults, and Livewire applies EnsureAdmin to updates.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

app/Providers/AppServiceProvider.php

@@ -2,12 +2,15 @@
 
 namespace App\Providers;
 
+use App\Http\Middleware\EnsureAdmin;
+use App\Http\Middleware\SystemPasswordGate;
 use App\Models\Setting;
 use Carbon\CarbonImmutable;
 use Illuminate\Support\Facades\Date;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\ServiceProvider;
 use Illuminate\Validation\Rules\Password;
+use Livewire\Livewire;
 use NoNameWeb\LivewireMaterial\Support\Scheme;
 
 class AppServiceProvider extends ServiceProvider
@@ -22,6 +25,9 @@ class AppServiceProvider extends ServiceProvider
         // The colour profile the admin chose in Admin settings; asked each time a page, mail or
         // error page draws its colours, so a new choice applies at once in every Octane worker.
         Scheme::resolveProfileUsing(fn (): ?string => Setting::get('color_profile'));
+
+        // Livewire updates apply a page route's middleware only when it is listed as persistent.
+        Livewire::addPersistentMiddleware([SystemPasswordGate::class, EnsureAdmin::class]);
     }
 
     /**

app/Providers/FortifyServiceProvider.php

@@ -62,7 +62,11 @@ class FortifyServiceProvider extends ServiceProvider
         RateLimiter::for('login', function (Request $request) {
             $throttleKey = Str::transliterate(Str::lower($request->input(Fortify::username())).'|'.$request->ip());
 
-            return Limit::perMinute(5)->by($throttleKey);
+            // The address comes from X-Forwarded-For behind the proxy, so a second limit per e-mail does not use it.
+            return [
+                Limit::perMinute(5)->by($throttleKey),
+                Limit::perMinute(20)->by(Str::transliterate(Str::lower($request->input(Fortify::username())))),
+            ];
         });
     }
 }